The Value of Forensic Accountants in Investigations

Not just crunching numbers

When financial misconduct surfaces in a company, those responsible for the internal investigation may feel as if they’re flying a kite in a hurricane. Changing enforcement priorities around the world, the development of new corporate criminal liability, conflict between the positions of individuals and their employers, and new data security consequences can all make the task quite daunting.

Yet when all the competing issues are worked through, one central requirement will always remain: how to work out what has happened, quickly and assuredly. Knowledge is power.

When a ‘red flag’ is raised, and a company considers it may have suffered or committed a financial crime, a lawyer is essential. Lawyers coordinate strategy, pay attention to legal and regulatory consequences, raise awareness of pitfalls and provide remedies, while creating defensive strategies and protecting information.

But why should the legal team be complemented with a more numerically savvy expert?

Forensic accountants are integral to the performance of a modern financial investigation. This chapter seeks to explain how the role is complementary to legal advisers, while supplementing the discussion about which skills to deploy and when.

The art of investigating

In the art world, spotting the difference between an authentic masterpiece and an impeccably forged fake can often hinge on the minutest of details. James Martin, the renowned forensic art analyst, has saved (and destroyed) many an art owner’s dreams by confirming or denying the authenticity of highly valued artworks. In one example investigated by Martin, a Rothko from 1956 was determined to be a fake – because of a ground layer of white paint between the canvas and the oils. During the relevant period, Rothko had used a transparent layer.

Uncovering complex financial crime is not dissimilar; it too requires a sophisticated lens. Imagine the books and records of a company as a painting – a work of art created by all the decisions, interactions with stakeholders, resulting transactions and their record-keeping by a business. This accounting system creates a dilemma for fraudsters: double-entry bookkeeping ensures that if value leaves a business, it must be recorded, so as attempts are made to conceal illicit activities, traces will remain. Internal investigations into financial misconduct require expertise that can look at the ‘painting’ and spot the inconsistencies. This will be easier in cases where the irregular behaviour may be obvious – an abuse of expenses or payments to a company controlled by an employee’s family member – akin to streaks of bright pink across an impressionist landscape. Alternatively, the aberrant behaviour may be well hidden in clever bribery or money laundering schemes – thus appearing as mere shading anomalies, comparable to the Rothko example above.

Forensic accountant investigators possess this lens. They can play a critical role in the focus and execution of investigations while providing a complementary skill set to lawyers, in more ways than one might think. Strong mutual support between the disciplines augurs well for clients facing a financial irregularity, combining the financial probity of forensic accountants with the surety of legal understanding.

The types of company crises for which this is true are broad and not limited to accounting oddities or quantifying loss. The forensic accounting investigator can be critical in a variety of matters: asset misappropriation, bribery and corruption, money laundering, competition infringements, employee misconduct issues, regulatory breaches, market abuse, cybercrimes, commercial disputes, and even acute investment or value decline.

The value of forensic accountant investigators

What is it that makes forensic accountant investigators so valuable when they support or lead internal investigations? Like all specialists, their attributes are more complex than one might first imagine. They include:

• an understanding of the accounting and control environment that surround transactions;
• an ability to appraise the commercial imperatives for different actors in the purchase and sales cycles;
• an understanding of where the repositories for evidence will be found and how to mine them;
• a well-practised forensic discipline of ensuring findings are objective and re-performable, applying the most advanced technology; and
• an ability to build the factual narrative amid the inevitable gaps in information.

Understanding the accounting and control environment

Forensic accountants are readily considered by the courts as appropriate experts where there are issues pertaining to financial misstatement, accounting anomalies, asset tracing and quantum. Uncovering whether and how financial crime has taken place requires the same expertise. The same core skills can be applied to the ‘blank canvas’ where there is little more than a concern; to identify the information sources relevant to the investigation.

A financial crime requires a transaction, and that requires accounting. Even if the crime is concealed – as most are – an oddity in the journal postings, a circumvention of controls or an inconsistency in the documentation or business purpose will exist in some form. While it may seem obvious that an accountant is the right expert to look into this, it may be tempting to rely on the company’s own finance function. This can be a mistake – they may be complicit, of course, but will almost certainly be captive, and as a result, blind to the ‘forgery’ in their midst.

It would be a shame to overlook this objective source of evidence too. So often, the perpetrators have a tidy story to dismiss concerns, but how they behave to work around the accounting system can be their undoing.

I recall coming into an investigation at a very late stage, where the legal team had focused its attention on the emails of and interviews with a broad set of senior and middle managers in response to a sanctions breach allegation. Despite consuming a whole lot of time and resources, progress was slow. The case turned on a redirected focus over two small departments’ activities in a subsidiary in Eastern Europe – the IT team and the finance function, following our assessment.

Appraisal of the commercial imperatives for different actors in the purchase or sales cycle

Businesses buy things and sell things. Those involved are subject to fundamental commercial obligations. When the stated purpose of a company is being subverted, at the front or the back door, a glitch in these rules will occur.

Forensic accountants have an innate understanding of these commercial drivers – being able to map the inconsistency of a particular decision to a corporate goal, and therefore the consistency with the fraud or criminal hypothesis. When reviewing a document or hearing an explanation, forensic accountants can picture that isolated evidence in relation to its links to transactional records and accounting ledgers, as well processes, controls, records, people, departments, decisions and strategy. Its place in the bigger picture is discernible. This skill has evolved with the development of forensic accounting as a specialised skill, with roots in the practice of financial audit, from which a large proportion of forensic accountants hail – literally understanding the perspectives of actors from the board room to the back office.

On one level, it is helpful to validate what ‘normal’ looks like in a particular business environment – something that will differ from one organisation to another. It is also important in order to challenge the perpetrators. Those who have committed crimes will try to convince others that there is nothing to see. They will likely have a well-practised rationale, answers and explanations that are used to hold those investigating them at arm’s length. It is much more difficult to put a forensic accountant off the scent.

It is not only fraudsters that an investigator has to be wary of. Most people who face a rather serious-looking lawyer or accountant have a tendency to lie, or be economical with the truth, to protect some perceived agenda. Relying too heavily on the witness’s first, or even second, account can be misleading without the right type of appraisal.

Mining all information sources simultaneously

In the large 1990s financial scandals, such as PolyPeck, BCCI and Barings, you would have been likely to come across financial auditors acting with a sceptical mindset in the pursuit of unpicking what had happened. The same games continue at companies around the world decades later, but the volumes of information and data have exploded, and so the rules of the game have changed for the professionals who must deal with them. Today, investigators look to multiple information sources and the importance of this cannot be overemphasised.

Modern investigators understand that you cannot simply point different experts at different information sources and then think on the results – if this is done, key evidence is likely to fall through the cracks. What is required is the ability to deploy analysis and interrogation of each source simultaneously and overlay the results. Sources will include finances and accounts, commercial records, interviews, unstructured data (such as emails and instant messaging), structured data and external sources to the company that requires deployment of intelligence gathering. Not only do forensic accountant investigators know where best to look, but they are also able to mine all of those varied information sources efficiently and effectively.

Following the collapse of a country’s main retail bank amid US$1 billion in losses, a forensic audit was required to successfully unravel a well-concealed loan book scheme. It was designed to have the look of a broad portfolio of risk-managed customers with performing facilities, but instead was a Ponzi scheme using depositor money to disguise massive insider lending to a select few. The sources required to be mined were broad, but the nexus included:

• taking the entire banking system data with associated accounting records and analysing linked accounts using data analytics;
• email reviews that, among other things, identified a report template that was later revealed to be the blueprint for the ‘black book’ or true ledger;
• interviews of the IT team that designed the report;
• interviews with the front office and review of the loan files; and
• discovering a ‘shadow’ screen in the front-end account opening portal.

Cracking the loan book scheme led to the identification of the handful of powerful ultimate beneficiaries behind the millions of ‘straw man’ loans and unravelled a complex money laundering scheme. We were able to robustly allocate the liable parties for the dispensed bank funds. This was some progress, given the same information was open to investigators, international authorities and agencies with superior powers, long before the forensic accountants arrived in the country for the first time.

Financial impropriety cases are so often solved through the juxtaposition of multiple sources and not a solitary ‘smoking gun’.

Mining the data in the right way

It is impossible to contemplate investigations today without considering how technology can assist, or even drive, the discovery of key evidence. From the perspective of the discovery of what has happened, large data sets need to be examined quickly and comprehensively, within defensible reason, to extract evidential material. The success of investigations is enhanced when the digital forensic solution is integrated with forensic accountant investigators. Their knowledge and regular use of the review tools available creates considerable value to clients.

This is especially true in relation to unstructured data. Linear reviews by remote or junior teams rarely deliver quick or cost-effective results. While smoking guns wait to be identified, the appreciation of the context of the actors, juxtaposed with information learnt from other information can be lacking, so they are overlooked.

A process of testing keywords and combinations accelerates the discovery of likely relevant documents. Additionally, the use of ‘unsupervised’ machine learning techniques such as categorisation and conceptual search allows pertinent communications to be consumed that would not necessarily be keyword-responsive.

‘Supervised’ machine learning or predictive coding technologies are now often deployed, but they are rarely a solution in isolation. Where the subject matter is a financial irregularity that is complicated or best kept concealed, it is more likely a review of a critical mass of documents, together with the commercial role of the actors and hypotheses of wrongdoing will be required before machine-learning techniques become incisive.

In one recent investigation into bribery concerns, a junior linear review was initiated in parallel to a workflow created by a small team of forensic accountants. They used a combination of highly iterative keywords, key time frames and concept searching; search terms and concepts can be quickly amended to remove false positives in the data population in an iterative fashion, while knowledge of other information sources can be brought in to significantly propel forward understanding as the case develops. In this example, the findings of the forensic accountant workflow were used in interviews, and the case completed before the parallel review had finished; a review that did not find all the relevant material, and missed key evidence.

Forensic accountants increasingly use visual tools and data analytics to analyse and present structured data too (such as financial data and accounting records). Accountants grow up manipulating data in spreadsheets. Financial data is also voluminous today, but tools can be deployed to produce dashboards that can be put together to form a story book as a concise way to visually present the narrative and extent of a problem. Behind the dashboards lies a combination of standard mathematical or scientific tests, together with bespoke analysis envisaged by the forensic accountant, for the issues at hand.

During recent investigations, we have built data visualisation dashboards to interpret trends and show anomalies from the beginning of the assignment. We have done this to test the investigation hypothesis before setting the strategy for reviewing other information sources. As more information around a subject grows, we adapt how the information is analysed and allow the analytics to run the same queries over new and independent data sets. The results can be shown dynamically as heat maps, graphs, charts, timelines and data pyramids.

Such technology is the modern-day corporate detective’s magnifying glass. The combination of technology with subject matter experts is potentially very powerful. However, as we evolve, the right mix is essential.

Confirming the investigation hypotheses set and its significance

The increasing power of regulators to level significant fines and interrupt business operations demands a transparent, thorough approach from the commencement of an investigation – long before any approach to the authorities is made, if one ever is. As companies work to keep the trust of regulators and authorities, they will need to demonstrate their decision-making process, particularly with regard to different types of information and what has been considered or disregarded. This requires teams experienced in supporting clients to report to the authorities and appreciate how information sources are viewed, the standards of preservation required, and how the findings that flow from the processing and review of the information will be evaluated.

But not all companies will want to get there. Various elements within a business understand that they should investigate problems of conduct, governance and ethics but may prefer not to. Unless clear indications of wrongdoing are determined quickly and placed within the wider business context so that they cannot be conveniently rationalised, it is likely that the enquiry will be shut down early. Forensic accountants understand that a narrative needs to be created that includes commercial imperatives and consequences, and will work to build this early and continuously.

In the early days of an inquiry, the gaps between data points and evidence are broad. Demonstrating what could link these through a well-articulated hypotheses set provides the logic for investigating and the required steps to do this. It is tough love. Sometimes companies will need to appreciate why they should not shut down a probe prematurely.

Working in tandem with lawyers, the forensic accountants can ensure the client is aware of what information has been included for review and advise on further information sources that should be interrogated, why they should be interrogated, and how this should be done, in order to avoid perceptions that the client has turned a blind eye to the activity.

The right team

A universal feature of investigations is that companies will need to make difficult judgement calls while the facts are incomplete. Because of the changing enforcement landscape, increasingly the process followed by an investigation and the decision-making processes of the corporate and its advisers may be scrutinised later. Owing to such a level of focus from enforcement authorities on corporations, the way an issue is investigated and handled can be as important as the behaviour it uncovers.

A failure to be able to show after the event that something was given appropriate attention can lead to an immediate loss of confidence. There is a big difference between an entity demonstrating it tried to make a judgement call properly but that call turned out to be flawed, and one that turns a blind eye to an issue. This is so important in ensuring the investigators retain the trust of these prosecuting agencies.

Where a financial irregularity might lead cannot always be predicted. Unfortunately, what might initially appear to be a questionable transaction, or a rogue employee seeking unfair enrichment, could readily involve breaches of various regulations and laws. Furthermore, if a third party is involved, regulators may find out irrespective of what official reporting a company does. Sweeping a matter under the carpet is a high-risk strategy.

The right team to perform an investigation into financial misconduct comprises the right skill sets. Professionals who overreach, sometimes with the wrong motivation, too often make mistakes. As such, there has perhaps never been a better time for combined lawyer and forensic accountant-driven investigations.